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One of the critical non-replaceable systems of a long-term manned orbital station is the propulsion system. Since 
the propulsion system operates beginning with the launch of station elements into orbit, its service life determines the 
service life of the station overall. 

Weighing almost a million pounds, the International Space Station (ISS) is about four times as large as the Russian 
space station Mir and about five times as large as the U.S. Skylab. Constructed over a span of more than a decade with 
the help of over 100 space flights, elements and modules of the ISS provide more research space than any spacecraft 
ever built. Originally envisaged for a service life of fifteen years, this Earth orbiting laboratory has been in orbit since 
1998. Some elements that have been launched later in the assembly sequence were not yet built when the first elements 
were placed in orbit. Hence, some of the early modules that were launched at the inception of the program were already 
nearing the end of their design life when the ISS was finally ready and operational. To maximize the return on global 
investments on ISS, it is essential for the valuable research on ISS to continue as long as the station can be sustained 
safely in orbit. This paper describes the work performed to extend the service life of the ISS propulsion system. 

A system comprises of many components with varying failure rates. Reliability of a system is the probability that 
it will perform its intended function under encountered operating conditions, for a specified period of time. As we are 
interested in finding out how reliable a system would be in the future, reliability expressed as a function of time 
provides valuable insight. 

In a hypothetical bathtub shaped failure rate curve, the failure rate, defined as the number of failures per unit time 
that a currently healthy component will suffer in a given future time interval, decreases during infant-mortality period, 
stays nearly constant during the service life and increases at the end when the design service life ends and wear-out 
phase begins. 

However, the component failure rates do not remain constant over the entire cycle life. The failure rate depends 
on various factors such as design complexity, current age of the component, operating conditions, severity of 
environmental stress factors, etc. Development, qualification and acceptance test processes provide rigorous screening 
of components to weed out imperfections that might otherwise cause infant mortality failures. 

If sufficient samples are tested to failure, the failure time versus failure quantity can be analyzed statistically to 
develop a failure probability distribution function (PDF), a statistical model of the probability of failure versus time. 
Driven by cost and schedule constraints however, spacecraft components are generally not tested in large numbers. 
Uncertainties in failure rate and remaining life estimates increase when fewer units are tested. To account for this, 
spacecraft operators prefer to limit useful operations to a period shorter than the maximum demonstrated service life 
of the weakest component. 

Running each component to its failure to determine the maximum possible service life of a system can become 
overly expensive and impractical. Spacecraft operators therefore, specify the required service life and an acceptable 
factor of safety (FOS). The designers use these requirements to limit the life test duration. Midway through the design 
life, when benefits justify additional investments, supplementary life test may be performed to demonstrate the 
capability to safely extend the service life of the system. 
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An innovative approach is required to evaluate the entire system, without having to go through an elaborate test 
program of propulsion system elements. Evaluating every component through a brute force test program would be a 
cost prohibitive and time consuming endeavor. ISS propulsion system components were designed and built decades 
ago. There are no representative ground test articles for some of the components. A ‘test everything’ approach would 
require manufacturing new test articles. The paper outlines some of the techniques used for selective testing, by way 
of cherry picking candidate components based on failure mode effects analysis, system level impacts, hazard analysis, 
etc. 

The type of testing required for extending the service life depends on the design and criticality of the component, 
failure modes and failure mechanisms, life cycle margin provided by the original certification, operational and 
environmental stresses encountered, etc. When specific failure mechanism being considered and the underlying 
relationship of that mode to the stresses provided in the test can be correlated by supporting analysis, time and effort 
required for conducting life extension testing can be significantly reduced. 

Exposure to corrosive propellants over long periods of time, for instance, lead to specific failure mechanisms in 
several components used in the propulsion system. Using Arrhenius model, which is tied to chemically dependent 
failure mechanisms such as corrosion or chemical reactions, it is possible to subject carefully selected test articles to 
accelerated life test. Arrhenius model reflects the proportional relationship between time to failure of a component 
and the exponential of the inverse of absolute temperature acting on the component. 

The acceleration factor is used to perform tests at higher stresses that allow direct correlation between the times to 
failure at a high test temperature to the temperatures to be expected in actual use. As long as the temperatures are such 
that new failure mechanisms are not introduced, this becomes a very useful method for testing to failure a relatively 
small sample of items for a much shorter amount of time. 

In this article, based on the example of the propulsion system of the first ISS module Zarya, theoretical approaches 
and practical activities of extending the service life of the propulsion system are reviewed with the goal of determining 
the maximum duration of its safe operation. 



